Subprocessors
Last updated: 2026-09-06
A subprocessor is a third party we engage to process personal data on our behalf when delivering the Service. We require each subprocessor to provide at least the level of data protection required of us under the applicable privacy laws, through binding contractual terms.
We notify users of material changes to this list with an in-product notice before the change takes effect, where reasonably possible.
Current subprocessors
| Subprocessor | Service | Personal data processed | Region(s) | Transfer mechanism |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, edge compute (Workers), object storage (R2), database (D1), vector store (Vectorize), key-value (KV), AI inference (Workers AI), DDoS protection | All categories — account info, site content, profile, embeddings, technical logs | Global edge network (incl. US, EU, UK, India) | EU/UK SCCs + Cloudflare DPA; India DPDP-compliant terms |
| Paddle.com Market Limited | Merchant of record: payment processing, tax collection and remittance, invoicing | Billing email, country, payment instrument (stored by Paddle, not us), subscription record | United Kingdom (HQ); global processing | UK ICO-recognised + EU SCCs; Paddle DPA |
A note on your identity provider
You sign in with an identity provider of your choice (currently Google; Microsoft and Apple are supported by our infrastructure and may be enabled). You authenticate with that provider directly over OpenID Connect — we operate the OIDC client ourselves, with no third-party authentication broker in between, and we never see or receive your password. The provider returns your email address, a stable account identifier, and your display name, which we store on your account record. Because it acts under its own privacy policy and your own relationship with it rather than processing data on our behalf, your identity provider is not our subprocessor and does not appear in the table above.
A note on your AI assistant provider
You use the Service through an MCP-compatible AI assistant of your choice — for example, Claude (made by Anthropic) or ChatGPT (made by OpenAI). That assistant is your interface to our connector. The provider processes the conversation you have with the assistant under its own privacy policy and your relationship with it — not as our subprocessor, which is why it does not appear in the table above. We do not actively send your data to the provider; the data flow is initiated by you through your assistant.
Our marketing site and dashboard also embed two short walkthrough videos hosted on YouTube, served through YouTube's privacy-enhanced youtube-nocookie.com player, which sets no cookies until you press play. Google processes playback under its own privacy policy — it is not our subprocessor and does not appear in the table above.
Similarly, if you connect a Cal.com booking link, visitors who book through your site interact with Cal.com under your own Cal.com account and Cal.com's privacy policy — Cal.com is not our subprocessor. See the Privacy Policy for details.
Sub-subprocessors
Our subprocessors may engage their own sub-subprocessors. Each is contractually required to flow down the same protections we require. We do not maintain a separate list of sub-subprocessors; current lists are maintained by each subprocessor and linked to from this page where available:
- Cloudflare: https://www.cloudflare.com/cloudflare-subprocessors/
- Paddle: https://www.paddle.com/legal/dpa (subprocessor schedule)
Adding a new subprocessor
We add a subprocessor only when we have a clear operational need and a contractual data-processing arrangement in place that meets the standard required by the privacy laws applicable to the data being processed.
Before a new subprocessor goes live with access to personal data: 1. It is recorded in this list with effective date, region, and the categories of data it will process; 2. We update the "Last updated" date above; 3. We notify users of material changes (typically at least 30 days in advance), giving you an opportunity to object before the change takes effect. If you object, you can close your account and request data export per the Privacy Policy.
Contact
If you have questions about any subprocessor on this list, write to privacy@playorparty.com.